Add SBOMEnabled field to CWSFeatureConfig for "package in use" feature

0intro · 0intro · commit 44dcf3f9de61 · 2026-04-16T10:44:09.000+02:00
Adds spec.features.cws.sbomEnabled to the DatadogAgent CRD, enabling
the CWS SBOM resolver to track runtime package usage. When enabled,
system-probe maps file accesses to packages and enriches SBOMs with
LastSeenRunning timestamps. The env var DD_RUNTIME_SECURITY_CONFIG_SBOM_ENABLED
is set on both system-probe and core agent containers.
diff --git a/api/datadoghq/v2alpha1/datadogagent_types.go b/api/datadoghq/v2alpha1/datadogagent_types.go
@@ -509,6 +509,13 @@ type CWSFeatureConfig struct {
 	// +optional
 	DirectSendFromSystemProbe *bool `json:"directSendFromSystemProbe,omitempty"`
 
+	// Enables the SBOM resolver to track runtime package usage.
+	// When enabled, system-probe maps file accesses to packages and enriches
+	// SBOMs with LastSeenRunning timestamps ("package in use" feature).
+	// Default: false
+	// +optional
+	SBOMEnabled *bool `json:"sbomEnabled,omitempty"`
+
 	Enforcement         *CWSEnforcementConfig         `json:"enforcement,omitempty"`
 	Network             *CWSNetworkConfig             `json:"network,omitempty"`
 	SecurityProfiles    *CWSSecurityProfilesConfig    `json:"securityProfiles,omitempty"`
diff --git a/api/datadoghq/v2alpha1/zz_generated.deepcopy.go b/api/datadoghq/v2alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml
@@ -1374,6 +1374,13 @@ spec:
                                 Default: true
                               type: boolean
                           type: object
+                        sbomEnabled:
+                          description: |-
+                            Enables the SBOM resolver to track runtime package usage.
+                            When enabled, system-probe maps file accesses to packages and enriches
+                            SBOMs with LastSeenRunning timestamps ("package in use" feature).
+                            Default: false
+                          type: boolean
                         securityProfiles:
                           properties:
                             enabled:
@@ -9806,6 +9813,13 @@ spec:
                                     Default: true
                                   type: boolean
                               type: object
+                            sbomEnabled:
+                              description: |-
+                                Enables the SBOM resolver to track runtime package usage.
+                                When enabled, system-probe maps file accesses to packages and enriches
+                                SBOMs with LastSeenRunning timestamps ("package in use" feature).
+                                Default: false
+                              type: boolean
                             securityProfiles:
                               properties:
                                 enabled:
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json
@@ -1369,6 +1369,10 @@
                   },
                   "type": "object"
                 },
+                "sbomEnabled": {
+                  "description": "Enables the SBOM resolver to track runtime package usage.\nWhen enabled, system-probe maps file accesses to packages and enriches\nSBOMs with LastSeenRunning timestamps (\"package in use\" feature).\nDefault: false",
+                  "type": "boolean"
+                },
                 "securityProfiles": {
                   "additionalProperties": false,
                   "properties": {
@@ -9538,6 +9542,10 @@
                       },
                       "type": "object"
                     },
+                    "sbomEnabled": {
+                      "description": "Enables the SBOM resolver to track runtime package usage.\nWhen enabled, system-probe maps file accesses to packages and enriches\nSBOMs with LastSeenRunning timestamps (\"package in use\" feature).\nDefault: false",
+                      "type": "boolean"
+                    },
                     "securityProfiles": {
                       "additionalProperties": false,
                       "properties": {
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml
@@ -1374,6 +1374,13 @@ spec:
                                     Default: true
                                   type: boolean
                               type: object
+                            sbomEnabled:
+                              description: |-
+                                Enables the SBOM resolver to track runtime package usage.
+                                When enabled, system-probe maps file accesses to packages and enriches
+                                SBOMs with LastSeenRunning timestamps ("package in use" feature).
+                                Default: false
+                              type: boolean
                             securityProfiles:
                               properties:
                                 enabled:
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json
@@ -1373,6 +1373,10 @@
                       },
                       "type": "object"
                     },
+                    "sbomEnabled": {
+                      "description": "Enables the SBOM resolver to track runtime package usage.\nWhen enabled, system-probe maps file accesses to packages and enriches\nSBOMs with LastSeenRunning timestamps (\"package in use\" feature).\nDefault: false",
+                      "type": "boolean"
+                    },
                     "securityProfiles": {
                       "additionalProperties": false,
                       "properties": {
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents.yaml b/config/crd/bases/v1/datadoghq.com_datadogagents.yaml
@@ -1378,6 +1378,13 @@ spec:
                                 Default: true
                               type: boolean
                           type: object
+                        sbomEnabled:
+                          description: |-
+                            Enables the SBOM resolver to track runtime package usage.
+                            When enabled, system-probe maps file accesses to packages and enriches
+                            SBOMs with LastSeenRunning timestamps ("package in use" feature).
+                            Default: false
+                          type: boolean
                         securityProfiles:
                           properties:
                             enabled:
@@ -9886,6 +9893,13 @@ spec:
                                     Default: true
                                   type: boolean
                               type: object
+                            sbomEnabled:
+                              description: |-
+                                Enables the SBOM resolver to track runtime package usage.
+                                When enabled, system-probe maps file accesses to packages and enriches
+                                SBOMs with LastSeenRunning timestamps ("package in use" feature).
+                                Default: false
+                              type: boolean
                             securityProfiles:
                               properties:
                                 enabled:
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json
@@ -1369,6 +1369,10 @@
                   },
                   "type": "object"
                 },
+                "sbomEnabled": {
+                  "description": "Enables the SBOM resolver to track runtime package usage.\nWhen enabled, system-probe maps file accesses to packages and enriches\nSBOMs with LastSeenRunning timestamps (\"package in use\" feature).\nDefault: false",
+                  "type": "boolean"
+                },
                 "securityProfiles": {
                   "additionalProperties": false,
                   "properties": {
@@ -9631,6 +9635,10 @@
                       },
                       "type": "object"
                     },
+                    "sbomEnabled": {
+                      "description": "Enables the SBOM resolver to track runtime package usage.\nWhen enabled, system-probe maps file accesses to packages and enriches\nSBOMs with LastSeenRunning timestamps (\"package in use\" feature).\nDefault: false",
+                      "type": "boolean"
+                    },
                     "securityProfiles": {
                       "additionalProperties": false,
                       "properties": {
diff --git a/docs/configuration.v2alpha1.md b/docs/configuration.v2alpha1.md
@@ -98,6 +98,7 @@ spec:
 | features.cws.enforcement.enabled | Enables Enforcement for Cloud Workload Security. Default: true |
 | features.cws.network.enabled | Enables Cloud Workload Security Network detections. Default: true |
 | features.cws.remoteConfiguration.enabled | Enables Remote Configuration for Cloud Workload Security. Default: true |
+| features.cws.sbomEnabled | Enables the SBOM resolver to track runtime package usage. When enabled, system-probe maps file accesses to packages and enriches SBOMs with LastSeenRunning timestamps ("package in use" feature). Default: false |
 | features.cws.securityProfiles.enabled | Enables Security Profiles collection for Cloud Workload Security. Default: true |
 | features.cws.syscallMonitorEnabled | SyscallMonitorEnabled enables Syscall Monitoring (recommended for troubleshooting only). Default: false |
 | features.dataPlane.dogstatsd.enabled | Configures the Data Plane to handle DogStatsD traffic. When enabled, DogStatsD is disabled in the Core Agent. Default: false |
diff --git a/docs/configuration_public.md b/docs/configuration_public.md
@@ -159,6 +159,9 @@ spec:
 `features.cws.remoteConfiguration.enabled`
 : Enables Remote Configuration for Cloud Workload Security. Default: true
 
+`features.cws.sbomEnabled`
+: Enables the SBOM resolver to track runtime package usage. When enabled, system-probe maps file accesses to packages and enriches SBOMs with LastSeenRunning timestamps ("package in use" feature). Default: false
+
 `features.cws.securityProfiles.enabled`
 : Enables Security Profiles collection for Cloud Workload Security. Default: true
 
diff --git a/internal/controller/datadogagent/feature/cws/envvar.go b/internal/controller/datadogagent/feature/cws/envvar.go
@@ -16,4 +16,5 @@ const (
 	DDRuntimeSecurityConfigRemoteConfigurationEnabled = "DD_RUNTIME_SECURITY_CONFIG_REMOTE_CONFIGURATION_ENABLED"
 	DDRuntimeSecurityConfigDirectSendFromSystemProbe  = "DD_RUNTIME_SECURITY_CONFIG_DIRECT_SEND_FROM_SYSTEM_PROBE"
 	DDRuntimeSecurityConfigEventGRPCServer            = "DD_RUNTIME_SECURITY_CONFIG_EVENT_GRPC_SERVER"
+	DDRuntimeSecurityConfigSBOMEnabled                = "DD_RUNTIME_SECURITY_CONFIG_SBOM_ENABLED"
 )
diff --git a/internal/controller/datadogagent/feature/cws/feature.go b/internal/controller/datadogagent/feature/cws/feature.go
@@ -51,6 +51,7 @@ type cwsFeature struct {
 	remoteConfigurationEnabled bool
 	directSendFromSystemProbe  bool
 	enforcementEnabled         bool
+	sbomEnabled                bool
 	useVSock                   bool
 
 	owner  metav1.Object
@@ -93,6 +94,8 @@ func (f *cwsFeature) Configure(dda metav1.Object, ddaSpec *v2alpha1.DatadogAgent
 		}
 		f.configMapName = constants.GetConfName(dda, f.customConfig, defaultCWSConf)
 
+		f.sbomEnabled = apiutils.BoolValue(cwsConfig.SBOMEnabled)
+
 		if cwsConfig.Enforcement != nil {
 			f.enforcementEnabled = apiutils.BoolValue(cwsConfig.Enforcement.Enabled)
 		}
@@ -278,6 +281,20 @@ func (f *cwsFeature) ManageNodeAgent(managers feature.PodTemplateManagers, provi
 		managers.EnvVar().AddEnvVarToContainer(apicommon.SystemProbeContainerName, rcEnvVar)
 	}
 
+	if f.sbomEnabled {
+		sbomEnvVar := &corev1.EnvVar{
+			Name:  DDRuntimeSecurityConfigSBOMEnabled,
+			Value: "true",
+		}
+		managers.EnvVar().AddEnvVarToContainers(
+			[]apicommon.AgentContainerName{
+				apicommon.SystemProbeContainerName,
+				apicommon.CoreAgentContainerName,
+			},
+			sbomEnvVar,
+		)
+	}
+
 	policiesDirEnvVar := &corev1.EnvVar{
 		Name:  DDRuntimeSecurityConfigPoliciesDir,
 		Value: securityAgentRuntimePoliciesDirVolumePath,
diff --git a/internal/controller/datadogagent/feature/cws/feature_test.go b/internal/controller/datadogagent/feature/cws/feature_test.go
@@ -93,6 +93,11 @@ func Test_cwsFeature_Configure(t *testing.T) {
 		ddaCWSLiteEnforcementEnabled.Spec.Features.CWS.Enforcement.Enabled = ptr.To(true)
 	}
 
+	ddaCWSSBOMEnabled := ddaCWSLiteEnabled.DeepCopy()
+	{
+		ddaCWSSBOMEnabled.Spec.Features.CWS.SBOMEnabled = ptr.To(true)
+	}
+
 	tests := test.FeatureTestSuite{
 		{
 			Name:          "v2alpha1 CWS not enabled",
@@ -103,32 +108,38 @@ func Test_cwsFeature_Configure(t *testing.T) {
 			Name:          "v2alpha1 CWS enabled",
 			DDA:           ddaCWSLiteEnabled,
 			WantConfigure: true,
-			Agent:         cwsAgentNodeWantFunc(false, false, false),
+			Agent:         cwsAgentNodeWantFunc(false, false, false, false),
 		},
 		{
 			Name:          "v2alpha1 CWS enabled (with network, security profiles and remote configuration)",
 			DDA:           ddaCWSFullEnabled,
 			WantConfigure: true,
-			Agent:         cwsAgentNodeWantFunc(true, false, false),
+			Agent:         cwsAgentNodeWantFunc(true, false, false, false),
 		},
 		{
 			Name:          "v2alpha1 CWS enabled in direct sender mode",
 			DDA:           ddaCWSLiteDirectSendEnabled,
 			WantConfigure: true,
-			Agent:         cwsAgentNodeWantFunc(false, true, false),
+			Agent:         cwsAgentNodeWantFunc(false, true, false, false),
 		},
 		{
 			Name:          "v2alpha1 CWS enabled with enforcement",
 			DDA:           ddaCWSLiteEnforcementEnabled,
 			WantConfigure: true,
-			Agent:         cwsAgentNodeWantFunc(false, false, true),
+			Agent:         cwsAgentNodeWantFunc(false, false, true, false),
+		},
+		{
+			Name:          "v2alpha1 CWS enabled with SBOM",
+			DDA:           ddaCWSSBOMEnabled,
+			WantConfigure: true,
+			Agent:         cwsAgentNodeWantFunc(false, false, false, true),
 		},
 	}
 
 	tests.Run(t, buildCWSFeature)
 }
 
-func cwsAgentNodeWantFunc(withSubFeatures bool, directSendFromSysProbe bool, enforcementEnabled bool) *test.ComponentTest {
+func cwsAgentNodeWantFunc(withSubFeatures bool, directSendFromSysProbe bool, enforcementEnabled bool, sbomEnabled bool) *test.ComponentTest {
 	return test.NewDefaultComponentTest().WithWantFunc(
 		func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
 			mgr := mgrInterface.(*fake.PodTemplateManagers)
@@ -196,6 +207,15 @@ func cwsAgentNodeWantFunc(withSubFeatures bool, directSendFromSysProbe bool, enf
 					},
 				)
 			}
+			if sbomEnabled {
+				sysProbeWant = append(
+					sysProbeWant,
+					&corev1.EnvVar{
+						Name:  DDRuntimeSecurityConfigSBOMEnabled,
+						Value: "true",
+					},
+				)
+			}
 			sysProbeWant = append(
 				sysProbeWant,
 				&corev1.EnvVar{
@@ -213,6 +233,29 @@ func cwsAgentNodeWantFunc(withSubFeatures bool, directSendFromSysProbe bool, enf
 			sysProbeEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.SystemProbeContainerName]
 			assert.True(t, apiutils.IsEqualStruct(sysProbeEnvVars, sysProbeWant), "System probe envvars \ndiff = %s", cmp.Diff(sysProbeEnvVars, sysProbeWant))
 
+			coreAgentEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.CoreAgentContainerName]
+			if sbomEnabled {
+				coreAgentSBOMWant := []*corev1.EnvVar{
+					{
+						Name:  DDRuntimeSecurityConfigEnabled,
+						Value: "true",
+					},
+					{
+						Name:  DDRuntimeSecurityConfigSocket,
+						Value: "/var/run/sysprobe/runtime-security.sock",
+					},
+					{
+						Name:  DDRuntimeSecurityConfigSyscallMonitorEnabled,
+						Value: "true",
+					},
+					{
+						Name:  DDRuntimeSecurityConfigSBOMEnabled,
+						Value: "true",
+					},
+				}
+				assert.True(t, apiutils.IsEqualStruct(coreAgentEnvVars, coreAgentSBOMWant), "Core agent envvars \ndiff = %s", cmp.Diff(coreAgentEnvVars, coreAgentSBOMWant))
+			}
+
 			// check volume mounts
 			securityWantVolumeMount := []corev1.VolumeMount{
 				{
